kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-01 18:21:29 +00:00
Code Issues Releases Packages Activity
linux/net/sched
History
Jamal Hadi Salim 581668893e net/sched: fix a qdisc modification with ambiguous command request 
[ Upstream commit da71714e35 ]

When replacing an existing root qdisc, with one that is of the same kind, the
request boils down to essentially a parameterization change  i.e not one that
requires allocation and grafting of a new qdisc. syzbot was able to create a
scenario which resulted in a taprio qdisc replacing an existing taprio qdisc
with a combination of NLM_F_CREATE, NLM_F_REPLACE and NLM_F_EXCL leading to
create and graft scenario.
The fix ensures that only when the qdisc kinds are different that we should
allow a create and graft, otherwise it goes into the "change" codepath.

While at it, fix the code and comments to improve readability.

While syzbot was able to create the issue, it did not zone on the root cause.
Analysis from Vladimir Oltean <vladimir.oltean@nxp.com> helped narrow it down.

v1->V2 changes:
- remove "inline" function definition (Vladmir)
- remove extrenous braces in branches (Vladmir)
- change inline function names (Pedro)
- Run tdc tests (Victor)
v2->v3 changes:
- dont break else/if (Simon)

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a3618a167af2021433cd@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/20230816225759.g25x76kmgzya2gei@skbuf/T/
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-08-30 16:11:03 +02:00
..
act_api.c net/sched: act_api: add specific EXT_WARN_MSG for tc action 2023-06-21 16:01:02 +02:00
act_bpf.c net: sched: act_bpf: simplify code logic in tcf_bpf_init() 2022-09-28 09:38:56 +01:00
act_connmark.c netfilter: conntrack: Fix data-races around ct mark 2022-11-18 15:21:00 +01:00
act_csum.c net: sched: act_csum: get rid of tcf_csum_walker and tcf_csum_search 2022-09-09 08:24:41 +01:00
act_ct.c netfilter: conntrack: Fix data-races around ct mark 2022-11-18 15:21:00 +01:00
act_ctinfo.c net/sched: act_ctinfo: use percpu stats 2023-02-22 12:59:52 +01:00
act_gact.c treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
act_gate.c net: sched: act_gate: get rid of tcf_gate_walker and tcf_gate_search 2022-09-09 08:24:42 +01:00
act_ife.c net: sched: act_ife: get rid of tcf_ife_walker and tcf_ife_search 2022-09-09 08:24:42 +01:00
act_ipt.c net/sched: act_ipt: add sanity checks on skb before calling target 2023-07-19 16:22:01 +02:00
act_meta_mark.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbprio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_mirred.c net/sched: act_mirred: Add carrier check 2023-05-17 11:53:34 +02:00
act_mpls.c net/sched: act_mpls: fix action bind logic 2023-03-11 13:55:28 +01:00
act_nat.c net: sched: act_nat: get rid of tcf_nat_walker and tcf_nat_search 2022-09-09 08:24:42 +01:00
act_pedit.c net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX 2023-07-19 16:22:05 +02:00
act_police.c net: sched: act_police: fix sparse errors in tcf_police_dump() 2023-06-14 11:15:21 +02:00
act_sample.c net/sched: act_sample: fix action bind logic 2023-03-11 13:55:28 +01:00
act_simple.c net: sched: act_simple: get rid of tcf_simp_walker and tcf_simp_search 2022-09-09 08:24:42 +01:00
act_skbedit.c net: sched: act_skbedit: get rid of tcf_skbedit_walker and tcf_skbedit_search 2022-09-09 08:24:42 +01:00
act_skbmod.c net: sched: act_skbmod: get rid of tcf_skbmod_walker and tcf_skbmod_search 2022-09-09 08:24:42 +01:00
act_tunnel_key.c net: sched: act_tunnel_key: get rid of tunnel_key_walker and tunnel_key_search 2022-09-09 08:24:42 +01:00
act_vlan.c net: sched: act_vlan: get rid of tcf_vlan_walker and tcf_vlan_search 2022-09-09 08:24:43 +01:00
cls_api.c net/sched: cls_api: Fix lockup on flushing explicitly created chain 2023-06-21 16:01:01 +02:00
cls_basic.c net: sched: use tc_cls_bind_class() in filter 2022-10-02 16:07:17 +01:00
cls_bpf.c net: sched: cls_bpf: Undo tcf_bind_filter in case of an error 2023-07-27 08:50:41 +02:00
cls_cgroup.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_flow.c net/sched: use tc_cls_stats_dump() in filter 2022-09-20 15:54:13 -07:00
cls_flower.c net/sched: flower: Ensure both minimum and maximum ports are specified 2023-07-23 13:49:26 +02:00
cls_fw.c net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 12:08:15 +02:00
cls_matchall.c net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms 2023-07-27 08:50:41 +02:00
cls_route.c net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 12:08:16 +02:00
cls_rsvp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
cls_rsvp.h net: sched: use tc_cls_bind_class() in filter 2022-10-02 16:07:17 +01:00
cls_rsvp6.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
cls_u32.c net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 12:08:15 +02:00
em_canid.c net: sched: kerneldoc fixes 2020-07-13 17:20:40 -07:00
em_cmp.c net: sched: fix misspellings using misspell-fixer tool 2020-11-10 17:00:28 -08:00
em_ipset.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_ipt.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_meta.c net_sched: em_meta: add READ_ONCE() in var_sk_bound_if() 2022-05-16 10:31:06 +01:00
em_nbyte.c net: sched: Return the correct errno code 2021-02-06 11:15:28 -08:00
em_text.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
em_u32.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ematch.c net_sched: reject TCF_EM_SIMPLE case for complex ematch module 2022-12-31 13:32:55 +01:00
Kconfig net/sched: Retire tcindex classifier 2023-03-11 13:55:16 +01:00
Makefile net/sched: Retire tcindex classifier 2023-03-11 13:55:16 +01:00
sch_api.c net/sched: fix a qdisc modification with ambiguous command request 2023-08-30 16:11:03 +02:00
sch_atm.c net: sched: atm: dont intepret cls results when asked to drop 2023-01-12 12:02:24 +01:00
sch_blackhole.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_cake.c Networking fixes for 6.1-rc2, including fixes from netfilter 2022-10-20 17:24:59 -07:00
sch_cbq.c net: sched: cbq: dont intepret cls results when asked to drop 2023-01-12 12:02:24 +01:00
sch_cbs.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_choke.c net: sched: choke: remove unused variables in struct choke_sched_data 2022-08-31 19:39:53 -07:00
sch_codel.c net: sched: remove redundant NULL check in change hook function 2022-09-01 08:06:45 +02:00
sch_drr.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_dsmark.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_etf.c net: sched: etf: remove true check in etf_enable_offload() 2022-09-01 20:08:32 -07:00
sch_ets.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_fifo.c net_sched: fix NULL deref in fifo_set_limit() 2021-10-01 14:59:10 -07:00
sch_fq.c net/sched: sch_fq: fix integer overflow of "credit" 2023-05-11 23:03:26 +09:00
sch_fq_codel.c Revert "net: sched: fq_codel: remove redundant resource cleanup in fq_codel_init()" 2022-10-19 13:47:09 +01:00
sch_fq_pie.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_frag.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2021-12-31 14:35:40 +00:00
sch_generic.c net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting 2023-06-21 16:01:01 +02:00
sch_gred.c net: sched: gred: prevent races when adding offloads to stats 2023-02-01 08:34:25 +01:00
sch_hfsc.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_hhf.c net: sched: remove redundant NULL check in change hook function 2022-09-01 08:06:45 +02:00
sch_htb.c net: sched: sch: Fix off by one in htb_activate_prios() 2023-02-22 12:59:56 +01:00
sch_ingress.c net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs 2023-06-09 10:34:03 +02:00
sch_mq.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_mqprio.c net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 2023-08-03 10:24:02 +02:00
sch_multiq.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_netem.c sch_netem: fix issues in netem_change() vs get_dist_table() 2023-08-16 18:27:31 +02:00
sch_pie.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_plug.c net: sched: remove redundant NULL check in change hook function 2022-09-01 08:06:45 +02:00
sch_prio.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_qfq.c net/sched: sch_qfq: reintroduce lmax bound check for MTU 2023-07-23 13:49:50 +02:00
sch_red.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_sfb.c Networking fixes for 6.1-rc2, including fixes from netfilter 2022-10-20 17:24:59 -07:00
sch_sfq.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_skbprio.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_taprio.c net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. 2023-08-11 12:08:15 +02:00
sch_tbf.c net/sched: use tc_qdisc_stats_dump() in qdisc 2022-09-22 17:34:10 -07:00
sch_teql.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00